Member Avatar for john khin 
while ($row = mysql_fetch_array($retval, MYSQL_ASSOC)) {
                            echo '<tr>';
                        echo '<td>' . $row['img_id'] . '</td>';
                        echo '<td>' . $row['picture'] . '</td>';
                        echo '<td>' . $row['category'] . '</td>';
                        echo '<td>' . $row['quantity'] . '</td>';
                        echo '<td>' . $row['title'] . '</td>';
                        echo '<td>' . $row['description'] . '</td>';
                        echo '<td><a class="btn btn-success" href="update.php?id=<?php echo $row[img_id];?>">Update</td>';              
                        echo '<td><a class="btn btn-danger" href="deleteComfirm.php?id=<?php echo $row[img_id];?>">Delete</td>';

                    }
  • 3 Contributors
  • 2 Replies
  • 208 Views
  • 5 Hours Discussion Span
  • Latest Post Latest Post by sankar.s789

Dani AI

Generated

Your code is printing literal PHP inside an echoed string (the <?php ... ?> text) instead of the img_id value, and a few anchor tags in the snippet are not actually closed. Break the HTML out of the echo and build each row with real values — it is clearer and avoids the quoting mistakes that cause the problem.

A safer, modern pattern: use PDO or mysqli, cast/validate the id, escape displayed text, and generate the table rows in plain HTML inside the loop. Example pattern (not the same as earlier replies):

// assume $stmt is a PDOStatement already executed
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
    $id = (int)$row['img_id'];
    $picture = htmlspecialchars($row['picture'], ENT_QUOTES);
    $title   = htmlspecialchars($row['title'], ENT_QUOTES);
    ?>
    <tr>
      <td><?php echo $id; ?></td>
      <td><?php echo $picture; ?></td>
      <td><?php echo $title; ?></td>
      <td><a class="btn btn-success" href="update.php?id=<?php echo $id; ?>">Update</a></td>
      <td>
        <form method="post" action="delete.php" style="display:inline">
          <input type="hidden" name="id" value="<?php echo $id; ?>">
          <button class="btn btn-danger" type="submit" onclick="return confirm('Delete this item?')">Delete</button>
        </form>
      </td>
    </tr>
    <?php
}

Additional tips:

  • Validate incoming ids in update.php/delete.php: filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT) (or INPUT_POST for deletes) and reject invalid values.
  • Use prepared statements for any DB access to prevent injections.
  • Use POST (forms) for destructive actions and add a CSRF token.
  • Make sure each <a> has a matching </a> and attributes are properly escaped.

was right to suggest concatenation and to avoid the old mysql_ API; tried a syntax change but it introduced other errors. The clean, maintainable approach is to stop echoing raw PHP tags inside strings, escape output, and move to PDO/mysqli for safety.

Recommended Answers

All 2 Replies

Member Avatar for Traevel

Same as you did with the <td>'s.

echo '<td><a class="btn btn-success" href="update.php?id='.$row['img_id'].'">Update</td>';

Also, don't use the mysql API, it's deprecated. Go with mysqli or PDO.

Edited by Traevel because: quotes
Member Avatar for sankar.s789

Simply change Syntax to
echo '<td><a class="btn btn-success" href="update.php?id="'.<?php echo $row[img_id];?>.'">Update</td>';

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.